add notes for IdP-initiated SSO